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Amendments to the Drawings : 

The attached sheets of drawings includes changes to Figs. 1-4, as follows: 
In Fig. 1, reference number 101 was removed and the lead lines for 1 1 1 and 1 13 
were corrected. 

In Figs. 2 and 3, the use of reference number 427 for Tier N was removed. 
In Fig. 4, reference numbers 341 and 342 were added and reference number 338 
was removed. 

Attachment: Replacement Sheets 
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REMARKS 

Applicant requests favorable reconsideration of this application as amended. 

The drawings and specification have been revised, where appropriate, to address 
the Examiner's objections to the drawings. The specification has also been editorially 
revised in order to place the application in better condition for issue. 

Applicant requests reconsideration of the obviousness-type double patenting 
rejection in view of the claim amendments contained herein and the concurrently-filed 
amendment in co-pending application serial number 09/973,769. 

Claims 1-10 stand rejected and will be discussed in detail below. New claims 1 1- 
20 have been added to provide more comprehensive protection for Applicant's invention. 
Accordingly, Claims 1-20 are pending for further consideration. 

Without acceding to the outstanding rejection under 36 U.S.C. 102(e), Claim 1 
has been amended to more clearly set forth certain distinctive features of the invention. 
Specifically, Claim 1 recites supplying identification information at a first node to a 
transmission received from the network even if a sender of the transmission is not 
identified, tracking network transmissions at the first node using the identification 
information and logging the identification information and a characteristic of the network 
transmission as traffic log information, communicating the traffic log information to 
another node. Further, Claim 1 recites disconnecting, at least temporarily, one or more 
nodes in the network to test for the origin and scope of a potential attack. The cited 
reference (U.S. Patent No. 6,321,338 to Porras) fails to teach or suggest the above- 
mentioned features of Claim 1. Thus, Claim 1, and its dependents distinguish patentably 
from the cited reference and should be allowed. 
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New independent Claims 1 1 and 16 also distinguish patentably from the cited 
reference. For example, Claim 1 1 recites temporarily disconnecting one or more nodes in 
the network to test for the origin and scope of a potential attack; and Claim 16 recites 
adding identification information to a transmission received at a first node from the 
network even if a sender of the transmission is not identified and tracking network 
transmissions at the first node using the identification information and logging the 
identification information and a characteristic of the network transmission as traffic log 
information. The cited references do not appear to teach or suggest the aforementioned 
features of Claims 1 1 and 16. Accordingly, new independent Claims 1 1 and 16, and their 
respective dependents are allowable. 

This application is now in condition for allowance and passage to issue is 
respectfully requested. 

Should the Examiner believe that any further action is necessary to place this 
application in better form for allowance, the Examiner is invited to contact Applicants' 
representative at the telephone number listed below. 
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The Commissioner is hereby authorized to charge to Deposit Account No. 50- 
1165 (T3497-9105US01) any fees under 37 C.F.R. §§ 1.16 and 1 . 1 7 that may be required 
by this paper and to credit any overpayment to that Account. If any extension of time is 
required in connection with the filing of this paper and has not been separately requested, 
such extension is hereby requested. 


Respectfully submitted, 


Date: September 22, 2005 



James T. Carmichael 
Reg. No. 45,306 


Miles & Stockbridge, P.C. 
1 75 1 Pinnacle Drive 
Suite 500 

McLean, Virginia 22102-3833 
(703) 903-9000 


Stephen W. Aycock II 
Reg. No! 52,579 
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